8 replies

accessing_from for a has_many relationship?

Ash🔒Policies

My understanding is that

acessing_from

acessing_from

acessing_from

acessing_from should allow me to authorize access to either side of a relationship.
https://hexdocs.pm/ash/Ash.Policy.Check.Builtins.html#accessing_from/2

I have

User

User

and

Profile

Profile

Profile

Profile resources that relate to each other, but only one side is being correctly authorized and I'm not sure why.

User

User

has_many :profiles, Profile

has_many :profiles, Profile

has_many :profiles, Profile

has_many :profiles, Profile

    policy action(:read) do
      authorize_if accessing_from(Profile, :user)
    end

    policy action(:read) do
      authorize_if accessing_from(Profile, :user)
    end

    policy action(:read) do
      authorize_if accessing_from(Profile, :user)
    end

    policy action(:read) do
      authorize_if accessing_from(Profile, :user)
    end

Profile

Profile

Profile

Profile

belongs_to :user, User

belongs_to :user, User

belongs_to :user, User

belongs_to :user, User

    policy action(:read) do
      authorize_if accessing_from(User, :user)
    end

    policy action(:read) do
      authorize_if accessing_from(User, :user)
    end

    policy action(:read) do
      authorize_if accessing_from(User, :user)
    end

    policy action(:read) do
      authorize_if accessing_from(User, :user)
    end

When I load the

user

user

user

user on one or more

Profile

Profile

Profile

Profiles, it works just fine.
When I try to load the

profiles

profiles

profiles

profiles on a

User

User

, it never is authorized.
When I replace this one line in my

Profile

Profile

Profile

Profile policies to

authorize_if always()

authorize_if always()

authorize_if always()

authorize_if always(), it works just fine, which is why I'm pretty sure it's

accessing_from

accessing_from

accessing_from

accessing_from that's the culprit.